Notion Warns of API Keys in Chats Exposed by Fireworks Breach

Notion says a cyberattack on its former AI infrastructure supplier Fireworks AI exposed some Notion AI Insights chat transcripts, prompting warnings to affected customers and a wider review of credentials that may have appeared in those conversations. The incident was not first discovered on 13 November. That date marks a later update to Notion’s security advisory, after the company had already begun notifying customers.

According to Notion, the intrusion involved Fireworks AI, a third-party provider that processed some AI requests. Notion said that fewer than 1% of workspaces were affected by exposure of AI Insights chat transcripts. It also said most of the exposed material was not attributable to a specific person. That qualification matters, but it does not make a chat transcript harmless. People sometimes paste account details, confidential work or credentials into AI tools.

Notion initially believed on 2 November that the data at issue was synthetic. By 6 November, it had identified the possibility of customer information in the affected material. A final dataset was received on 8 November, and customers were notified from 9 November. Notion disabled the affected AI Insights capability and disconnected Fireworks while it investigated. TechCrunch reported the customer impact on 12 November.

The company later widened its response to credentials. Its advisory says it revoked exposed Notion API keys on 11 November and reported third-party API keys found in the material to their issuers on 12 November. Notion advised affected workspaces to rotate credentials pasted into relevant chats. These steps do not establish that every key was misused. They show why a transcript breach can become an access-control incident even when the underlying application itself was not directly compromised.

The case illustrates a less visible risk in workplace AI. A user may think a conversation stays within the application on screen, while some of its processing is handled by another company. That chain can bring legitimate speed and capability, but it also means customer data may be present in a supplier’s systems. The exposure here was tied to that supplier relationship, according to Notion’s account, not to a general breach of every Notion workspace.

Organisations using AI assistants should now check which workspaces received Notion’s notice, identify any secrets shared in AI Insights chats and rotate them where necessary. They should review service accounts and third-party API tokens alongside ordinary passwords, because a pasted token can remain useful to an attacker after the conversation itself is deleted. Teams can also reduce exposure by keeping production credentials out of prompts and using short-lived, scoped tokens for testing.

For Notion, the near-term test is whether its notifications and remediation give customers enough information to assess their own exposure. For the wider industry, the incident is a reminder that AI features inherit the security posture of the services behind them. A vendor’s claim that data is processed securely has to extend through the full chain, not stop at its own login screen.